Some forms of WAN firewalls have been around for a couple of decades. It is hard to deny that firewalls are helpful. They are. It is also hard to argue that they are very exciting. In fact, since the turn of the century the types of security threats facing IT organizations has changed dramatically while the WAN firewall has not added much new functionality. That situation appears to be changing. As we’ll explain in the next couple of newsletters, a next-generation WAN firewall is being deployed that is intended to combat the security threats of the 21st century.

Our industry uses the phrase “next-generation” somewhat indiscriminately. For example, vendors often use the phrase to describe a simple upgrade to one of their products. That kind of hyperbole has the tendency of creating cynicism on the part of IT organizations. As part of our trying to avoid getting caught up in the overzealous enthusiasm of some marketing VP, we will state our belief that a next-generation product should be fundamentally different than anything that is currently available on the market.

Before we get to the topic of what a next-generation firewall would look like, we want to briefly look at how firewalls have or have not evolved. For starters, it is helpful to realize that the first generation of firewalls was referred to as packet filters. These devices functioned by inspecting packets to see if the packet matched the packet filter's set of rules. Packet filters acted on each individual packet (i.e., 5-tuple consisting of the source and destination addresses, the protocol and the port numbers) and did not pay any attention to whether or not a packet was part of an existing stream or flow of traffic.

Today most firewalls are based on stateful inspection. According to Wikipedia, "A stateful firewall is able to hold in memory significant attributes of each connection, from start to finish. These attributes, which are collectively known as the state of the connection, may include such details as the IP addresses and ports involved in the connection and the sequence numbers of the packets traversing the connection. The most CPU intensive checking is performed at the time of setup of the connection. All packets after that (for that session) are processed rapidly because it is simple and fast to determine whether it belongs to an existing, pre-screened session. Once the session has ended, its entry in the state-table is discarded."

Steve Taylor is president of Distributed Networking Associates and publisher/editor-in-chief of Webtorials. Jim Metzler is vice president of Ashton, Metzler & Associates.